Select the product you need help with

Forefront TMG Firewall service might crash when WP_TRAFFIC tracing is enabled in Forefront TMG 2010

Article ID: 2502686 - View products that this article applies to.

SYMPTOMS

When the WP_TRAFFIC tracing feature is enabled on a Microsoft Forefront Threat Management Gateway (TMG) 2010 server, the Forefront TMG Firewall service might crash.

In addition, you might receive the following events in the event log:

Log Name: Application
Source:        Microsoft Forefront TMG Firewall
Date:          <Date>
Event ID:      14057
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:     <FQDN>

Description:

The Firewall service stopped because an application filter module C:\Program Files\Microsoft Forefront Threat Management Gateway\w3filter.dll generated an exception code C0000005 in address 0000000071CC0B14 when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.

Log Name: Application
Source:        Application Error
Date:          <Date>
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <FQDN>

Description:

Faulting application name: wspsrv.exe, version: 7.0.9027.400, time stamp: 0x4c8cade1
Faulting module name: w3filter.dll, version: 7.0.9027.400, time stamp: 0x4c8cae41
Exception code: 0xc0000005
Fault offset: 0x0000000000050b14
Faulting process id: 0x1468
Faulting application start time: 0x01cc59b49d593ba1
Faulting application path: C:\Program Files\Microsoft Forefront Threat Management Gateway\wspsrv.exe
Faulting module path: C:\Program Files\Microsoft Forefront Threat Management Gateway\w3filter.dll

Note This issue does not occur if the WP_TRAFFIC tracing feature is disabled.